No privacy options for users

User accounts I am testing do not have the ability to change permissions for who can view what info on them. I set it up so the default was only friends, and users could change that, but it does not block the info. Am I missing something?